Risk assessment-based enterprise safety behavior analysis method and system

Abstract

The invention relates to the technical field of data security, in particular to an enterprise security behavior analysis method and system based on risk assessment, and the method comprises the steps: collecting a current risk assessment behavior of a to-be-analyzed enterprise in real time after the to-be-analyzed enterprise reports a risk assessment instruction demand; based on the risk assessment behavior mapping table and the risk assessment behaviors, obtaining a risk assessment safety degree; pushing the risk assessment safety degree to the to-be-analyzed enterprise; and when the to-be-analyzed enterprise browses the risk assessment security degree, reporting a help-seeking instruction demand, querying associated upstream and downstream enterprises for the to-be-analyzed enterprise, and performing interaction analysis on the to-be-analyzed enterprise and the associated enterprise. According to the method, the incidence relation between the safety risk of the enterprise in each current state and the occurrence of the emergencies in various different scenes can be fully mined, and a practical evaluation result and a rectification scheme are provided.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a method and system for analyzing enterprise security behavior based on risk assessment. Background Art

[0002] In recent years, the flow of corporate business has been relatively active, and Chinese companies are also facing current problems in business management. In many industries, the phenomenon of poor business communication is becoming more and more serious, and the inefficiency of key businesses will have a great negative impact on the development of enterprises. When key core businesses have risk tendencies, companies can predict and formulate perfect treatment plans in advance, which will greatly reduce operating losses. Enterprise managers need to use certain tools and methods to perform business risk prediction so as to take timely response measures.

[0003] Within the enterprise, how to reasonably manage behavioral safety risks within the enterprise is a difficult problem in the current environment. The existing management model still tends to be traditional management, lacks changes under the new intelligent manufacturing concept, and traditional resource management has drawbacks. This management model will reduce or even lose employees' sense of identity with the enterprise, which may lead to increased enterprise risks. Summary of the invention

[0004] In order to solve the problems existing in the above-mentioned prior art, the present invention provides a method and system for analyzing enterprise security behavior based on risk assessment, which can fully explore the correlation between the security risks of enterprises in the current state under various scenarios and the occurrence of emergencies, and put forward practical assessment results and rectification plans.

[0005] According to a first aspect of the present invention, the present invention claims protection for a method for analyzing enterprise security behavior based on risk assessment, comprising:

[0006] When the enterprise to be analyzed reports the risk assessment instruction requirements, the current risk assessment behavior of the enterprise to be analyzed is collected in real time;

[0007] Based on the risk assessment behavior mapping table and the risk assessment behavior, the risk assessment safety degree is obtained;

[0008] Push risk assessment safety to the enterprise to be analyzed;

[0009] When the enterprise to be analyzed reports the need for assistance when browsing the risk assessment safety level, the enterprise to be analyzed queries the related upstream and downstream enterprises for interaction;

[0010] Perform interactive analysis on the enterprise to be analyzed and its related enterprises.

[0011] Furthermore, performing interactive analysis on the enterprise to be analyzed and its associated enterprises includes:

[0012] Log the behavior node attribute data of the enterprise to be analyzed and receive the log record queue;

[0013] Generates analysis behavior mapping table of logging queue;

[0014] When the first cross-business obtained by the enterprise to be analyzed and the associated enterprise in the first cycle meets the first activation environment, the second cross-business obtained by the enterprise to be analyzed in the second cycle is subjected to element analysis, and a first element set is received;

[0015] According to the analysis behavior mapping table, based on the first element set, a first analysis safety degree is obtained;

[0016] Push the first analysis safety level to related enterprises;

[0017] When the third cross-business obtained by the associated enterprise in the third period meets the second activation environment, the first analysis safety level is pushed to the enterprise to be analyzed; otherwise, the fourth cross-business obtained by the associated enterprise in the fourth period is subjected to element analysis, and a second element set is received;

[0018] According to the analysis behavior mapping table, based on the second element set, a second analysis safety degree is obtained;

[0019] Push the second analysis safety level to the enterprise to be analyzed;

[0020] The first period is the period after the enterprise to be analyzed and the associated enterprise start to interact, and the random range interval is the upper limit of the first range interval;

[0021] The second period is consistent with the source range stamp of the first period; the interval by which the second period is greater than the first period is equal to the upper limit of the second range interval;

[0022] The third period is after the second period and adjacent to the second period; the range interval of the third period is equal to the upper limit of the third range interval;

[0023] The source range stamp of the fourth period is consistent with that of the third period; the interval by which the fourth period is greater than the third period is equal to the upper limit of the fourth range.

[0024] Furthermore, the analysis behavior mapping table of generating the log record queue includes:

[0025] Collect multiple sets of one-to-one associated analysis samples and reference log record queues;

[0026] Query the logging queue with any reference logging queue;

[0027] When the query is satisfied, the analysis samples associated with the reference log record queue that satisfies the query are used as samples to be queued;

[0028] Generate an analysis behavior mapping table based on the samples to be added to the team.

[0029] Furthermore, the first activation environment includes:

[0030] The coordinate sequence number of the first channel containing the first compliance keyword in the first cross-business is in the first reference sequence number interval; and / or,

[0031] The number of first channels obtained by the enterprise to be analyzed in the first cross-business is not less than the first upper limit; and / or,

[0032] The number of pairs of mutual first channels obtained in the cross-range in the first cross-service is not less than the second upper limit.

[0033] Furthermore, the second activation environment includes:

[0034] The number of second channels in the third cross-business that contain the second compliance keyword with the first analysis safety level is not less than the third upper limit; and / or,

[0035] The second channel in the third cross-business whose coordinate sequence number is in the second reference sequence number interval contains the third compliance keyword; and / or,

[0036] The second channel whose coordinate serial number in the third cross-business is in the third reference serial number interval includes the fourth compliance keyword.

[0037] According to a second aspect of the present invention, the present invention claims protection for an enterprise security behavior analysis system based on risk assessment, comprising:

[0038] A real-time collection unit is used to collect the current risk assessment behavior of the enterprise to be analyzed in real time after the enterprise to be analyzed reports the risk assessment instruction requirements;

[0039] A safety degree obtaining unit is used to obtain a risk assessment safety degree based on a risk assessment behavior mapping table and a risk assessment behavior;

[0040] A safety degree push unit is used to push the risk assessment safety degree to the enterprise to be analyzed;

[0041] The enterprise query unit is used to query the upstream and downstream enterprises related to the enterprise to be analyzed for interaction after reporting the request for help when browsing the risk assessment safety degree of the enterprise to be analyzed;

[0042] The interactive analysis unit is used to perform interactive analysis on the enterprise to be analyzed and its related enterprises.

[0043] Furthermore, the interactive analysis unit performs interactive analysis on the enterprise to be analyzed and the associated enterprises, including:

[0044] Log the behavior node attribute data of the enterprise to be analyzed and receive the log record queue;

[0045] Generates analysis behavior mapping table of logging queue;

[0046] When the first cross-business obtained by the enterprise to be analyzed and the associated enterprise in the first cycle meets the first activation environment, the second cross-business obtained by the enterprise to be analyzed in the second cycle is subjected to element analysis, and a first element set is received;

[0047] According to the analysis behavior mapping table, based on the first element set, a first analysis safety degree is obtained;

[0048] Push the first analysis safety level to related enterprises;

[0049] When the third cross-business obtained by the associated enterprise in the third period meets the second activation environment, the first analysis safety level is pushed to the enterprise to be analyzed; otherwise, the fourth cross-business obtained by the associated enterprise in the fourth period is subjected to element analysis, and a second element set is received;

[0050] According to the analysis behavior mapping table, based on the second element set, a second analysis safety degree is obtained;

[0051] Push the second analysis safety level to the enterprise to be analyzed;

[0052] The first period is the period after the enterprise to be analyzed and the associated enterprise start to interact, and the random range interval is the upper limit of the first range interval;

[0053] The second period is consistent with the source range stamp of the first period; the interval by which the second period is greater than the first period is equal to the upper limit of the second range interval;

[0054] The third period is after the second period and adjacent to the second period; the range interval of the third period is equal to the upper limit of the third range interval;

[0055] The source range stamp of the fourth period is consistent with that of the third period; the interval by which the fourth period is greater than the third period is equal to the upper limit of the fourth range.

[0056] Furthermore, the interaction analysis unit generates an analysis behavior mapping table of the log record queue, including:

[0057] Collect multiple sets of one-to-one associated analysis samples and reference log record queues;

[0058] Query the logging queue with any reference logging queue;

[0059] When the query is satisfied, the analysis samples associated with the reference log record queue that satisfies the query are used as samples to be queued;

[0060] Generate an analysis behavior mapping table based on the samples to be added to the team.

[0061] Furthermore, the first activation environment includes:

[0062] The coordinate sequence number of the first channel containing the first compliance keyword in the first cross-business is in the first reference sequence number interval; and / or,

[0063] The number of first channels obtained by the enterprise to be analyzed in the first cross-business is not less than the first upper limit; and / or,

[0064] The number of pairs of mutual first channels obtained in the cross-range in the first cross-service is not less than the second upper limit.

[0065] Furthermore, the second activation environment includes:

[0066] The number of second channels in the third cross-business that contain the second compliance keyword with the first analysis safety level is not less than the third upper limit; and / or,

[0067] The second channel in the third cross-business whose coordinate sequence number is in the second reference sequence number interval contains the third compliance keyword; and / or,

[0068] The second channel whose coordinate serial number in the third cross-business is in the third reference serial number interval includes the fourth compliance keyword.

[0069] The present invention relates to the field of data security technology, and specifically to a method and system for analyzing enterprise security behavior based on risk assessment. When an enterprise to be analyzed reports a risk assessment instruction demand, the current risk assessment behavior of the enterprise to be analyzed is collected in real time; based on a risk assessment behavior mapping table and risk assessment behavior, a risk assessment safety degree is obtained; the risk assessment safety degree is pushed to the enterprise to be analyzed; when the enterprise to be analyzed browses the risk assessment safety degree and reports a request for a help instruction, the enterprise to be analyzed queries the related upstream and downstream enterprises to perform interactive analysis, and the enterprise to be analyzed and the related enterprises perform interactive analysis. The present invention can fully explore the correlation between the security risks of various current state enterprises in various different scenarios and the occurrence of emergencies, and put forward practical evaluation results and rectification plans. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 A workflow diagram of a method for analyzing enterprise security behaviors based on risk assessment according to the present invention;

[0071] Figure 2 The present invention relates to a structural unit diagram of an enterprise security behavior analysis system based on risk assessment. DETAILED DESCRIPTION

[0072] The embodiment of the present invention provides a method for analyzing enterprise security behavior based on risk assessment, such as Figure 1 As shown, including:

[0073] S1. When the enterprise to be analyzed reports the risk assessment instruction demand, the current risk assessment behavior of the enterprise to be analyzed is collected in real time;

[0074] S2. Based on the risk assessment behavior mapping table and the risk assessment behavior, the risk assessment safety degree is obtained;

[0075] S3. Push the risk assessment safety level to the enterprise to be analyzed;

[0076] S4. When the enterprise to be analyzed reports the need for assistance when browsing the risk assessment safety, query the upstream and downstream enterprises related to the enterprise to be analyzed for interaction;

[0077] S5. Perform interactive analysis on the enterprise to be analyzed and its related enterprises.

[0078] When the enterprise to be analyzed needs to perform medical market risk assessment, it shall report the risk assessment instruction demand, which includes its name, operation time, enterprise type, risk assessment type, etc. At this time, the current risk assessment behavior of the enterprise to be analyzed is collected in real time. The current risk assessment behavior refers to the newly obtained risk assessment behavior of the enterprise to be analyzed, which can be before risk assessment, during risk assessment, after risk assessment, etc. There are a large number of risk assessment samples in the risk assessment behavior mapping table. The risk assessment samples can be the precautions that need to be known by the behavior nodes in different risk assessment behaviors, and can also be the specific process of risk assessment operation. The specific process can be simulated in the form of animation to simulate the process operation of medical market risk assessment. Therefore, based on the risk assessment behavior mapping table and the risk assessment behavior, the risk Risk assessment safety level, which includes precautions, specific procedures for risk assessment operations, etc.; the risk assessment safety level is pushed to the enterprise to be analyzed, and the enterprise to be analyzed can browse the risk assessment safety level, understand the precautions for execution, and become familiar with the specific procedures for risk assessment operations; at this time, the enterprise to be analyzed can not only take corresponding measures based on the precautions, but also be familiar with the specific procedures for risk assessment operations, so as to minimize the acquisition of adverse conditions; there is no need for risk control personnel to intervene, thus reducing labor costs; secondly, this application also makes special considerations for the enterprise to be analyzed, that is, the enterprise to be analyzed still needs to communicate with the risk control personnel, then they can report the need for help instructions, and query the related upstream and downstream enterprises for the enterprise to be analyzed to execute interaction, but in order to improve its communication efficiency, interactive analysis is performed on the enterprise to be analyzed and its related enterprises.

[0079] This application collects the current risk assessment behavior of the enterprise to be analyzed in real time, obtains the risk assessment safety degree based on the risk assessment behavior mapping table and the risk assessment behavior, and pushes the risk assessment safety degree to the enterprise to be analyzed. The behavior node can continuously and conveniently learn about precautions, and can also become familiar with the risk assessment process to reduce the acquisition of adverse conditions. In addition, under special circumstances, the behavior node can still communicate with related enterprises, and the system will perform communication analysis on them to improve communication efficiency.

[0080] In one embodiment, performing interactive analysis on the enterprise to be analyzed and its associated enterprises includes:

[0081] Log the behavior node attribute data of the enterprise to be analyzed and receive the log record queue;

[0082] Generates analysis behavior mapping table of logging queue;

[0083] When the first cross-business obtained by the enterprise to be analyzed and the associated enterprise in the first cycle meets the first activation environment, the second cross-business obtained by the enterprise to be analyzed in the second cycle is subjected to element analysis, and a first element set is received;

[0084] According to the analysis behavior mapping table, based on the first element set, a first analysis safety degree is obtained;

[0085] Push the first analysis safety level to related enterprises;

[0086] When the third cross-business obtained by the associated enterprise in the third period meets the second activation environment, the first analysis safety level is pushed to the enterprise to be analyzed; otherwise, the fourth cross-business obtained by the associated enterprise in the fourth period is subjected to element analysis, and a second element set is received;

[0087] According to the analysis behavior mapping table, based on the second element set, a second analysis safety degree is obtained;

[0088] Push the second analysis safety level to the enterprise to be analyzed;

[0089] The first period is the period after the enterprise to be analyzed and the associated enterprise start to interact, and the random range interval is the upper limit of the first range interval;

[0090] The second period is consistent with the source range stamp of the first period; the interval by which the second period is greater than the first period is equal to the upper limit of the second range interval;

[0091] The third period is after the second period and adjacent to the second period; the range interval of the third period is equal to the upper limit of the third range interval;

[0092] The source range stamp of the fourth period is consistent with that of the third period; the interval by which the fourth period is greater than the third period is equal to the upper limit of the fourth range.

[0093] The behavior node attribute data includes: the medical market risk assessment history of the enterprise to be analyzed, the medical market risk record history, the type of medical market risk assessment this time, etc.; the behavior node attribute data log is recorded as a log record queue in the form of a queue; an analysis behavior mapping table of the log record queue is generated, and the analysis behavior mapping table contains analysis samples applicable to the enterprise to be analyzed. For example, if the medical market risk assessment history of the enterprise to be analyzed is empty, it means that the enterprise to be analyzed is performing the medical market risk assessment for the first time, and the oscillation and instability state will be strong. Then the analysis sample in the generated analysis behavior mapping table is the state adjustment safety degree of the behavior node for the first execution of the medical market risk assessment, etc.; the first cross-business is obtained by the interaction between the enterprise to be analyzed and the associated enterprise. When the first cross-business meets the first activation environment, it means that the enterprise to be analyzed and the associated enterprise need to perform interactive analysis; the second cross-business is obtained by the enterprise to be analyzed alone, and the element analysis is performed on it to receive the first element set; the first element set reflects the needs of the enterprise to be analyzed. Therefore, the first analysis safety degree can be obtained based on the analysis behavior mapping table and the first element set. The first analysis safety degree is used to analyze the response of the associated enterprise to the execution demand of the enterprise to be analyzed. For example, the first element set reflects the negative impact of the enterprise to be analyzed When the risk controller conducts risk assessment on its business, the first analysis safety degree can be a strategy for adjusting the execution status of the enterprise to be analyzed, etc.; the first analysis safety degree is pushed to the associated enterprise so that it can respond to the execution needs of the enterprise to be analyzed as soon as possible and effectively; the third cross business is obtained separately by the associated enterprise. When the third cross business meets the second activation environment, it means that the associated enterprise responds to the execution needs of the enterprise to be analyzed according to the first analysis safety degree, and the first analysis safety degree can be pushed directly to the enterprise to be analyzed; the fourth cross business is obtained separately by the associated enterprise; if the third cross business does not meet the second activation environment, the fourth cross business is subjected to element analysis and a second element set is received; according to the analysis behavior mapping table, based on the second element set, a second analysis safety degree is obtained, and the second element set reflects the opinions on the response to the needs of the associated enterprise itself. In the case of the second analysis safety degree, the analysis sample associated with the opinions on the response to the needs of the associated enterprise itself can be obtained from the analysis behavior mapping table to generate the second analysis safety degree. For example, the second analysis safety degree reflects that the associated enterprise hopes that the enterprise to be analyzed will further understand the risk assessment process. After being very familiar with it, the negative state will be alleviated. The second analysis safety degree generated based on the corresponding analysis sample is to further understand the risk assessment process; the second analysis safety degree is pushed to the enterprise to be analyzed. The upper limit of the first range interval can be 30 seconds; the upper limit of the second range interval can be 60 seconds; the upper limit of the third range interval can be 20 seconds; the upper limit of the fourth range interval can be 40 seconds; the second period is set in this way, so that the first analysis safety degree obtained is obtained based on the first period and a certain range of enterprise market behavior elements to be analyzed thereafter, thereby improving comprehensiveness and rationality; the fourth period is set in the same way.

[0094] When the embodiment of the present invention performs interactive analysis on the enterprise to be analyzed and its related enterprises, a first activation environment is introduced to accurately obtain the timing for the enterprise to be analyzed and its related enterprises to perform interactive analysis, thereby reducing the analysis resources of the system and improving the analysis efficiency; secondly, an analysis behavior mapping table and a first element set are introduced to comprehensively and reasonably obtain a first analysis safety degree, so that the related enterprises can quickly know how to respond to the needs of the enterprise to be analyzed; then, the analysis behavior mapping table is used to obtain a second analysis safety degree based on the second element set, so that the enterprise to be analyzed can quickly know the response opinions of the related enterprises; the intelligence level of the interactive analysis performed between the enterprise to be analyzed and its related enterprises is greatly improved.

[0095] In one embodiment, the generating of the analysis behavior mapping table of the log record queue includes:

[0096] Collect multiple sets of one-to-one associated analysis samples and reference log record queues;

[0097] Query the logging queue with any reference logging queue;

[0098] When the query is satisfied, the analysis samples associated with the reference log record queue that satisfies the query are used as samples to be queued;

[0099] Generate an analysis behavior mapping table based on the samples to be added to the team.

[0100] A reference log record queue is set for each analysis sample. When the log record queue formed by the behavior node attribute data log record satisfies the reference log record queue query, it means that the analysis sample associated with the reference log record queue that satisfies the query is applicable to the enterprise to be analyzed and is used as the sample to be entered into the queue; an analysis behavior mapping table is generated based on the sample to be entered into the queue; when setting the reference log record queue for the analysis sample, the behavior node attribute data of the enterprise to be analyzed that the analysis sample is applicable to can be obtained first, and the behavior node attribute data is logged to construct a reference log record queue. For example: if the analysis sample is to adjust the safety of the enterprise to be analyzed that performs the medical market risk assessment for the first time, the behavior node attribute data applicable to the enterprise to be analyzed is zero for the number of historical medical market risk assessments.

[0101] In one embodiment, the first activation environment includes:

[0102] Environment A1: the coordinate sequence number of the first channel containing the first compliance keyword in the first cross-business is in the first reference sequence number interval; and / or,

[0103] Environment A2: the number of first channels obtained by the enterprise to be analyzed in the first cross-business is not less than the first upper limit; and / or,

[0104] Environment A3: The number of pairs of mutual first channels obtained by the cross-range in the first cross-service is not less than the second upper limit.

[0105] In environment A1, the first compliance keyword reflects that the enterprise to be analyzed must comply with laws and regulations in the process of production and operation, including the legal provisions and regulatory provisions of the country where the company is headquartered and the country where the operation is located; the first reference serial number interval can be the first 1 to 3 in the sequence and the last 1 to 3 in the sequence, etc. When the coordinate serial number of the first channel containing the first compliance keyword in the first cross-business is in the first reference serial number interval, it means that when the enterprise to be analyzed obtains the first cross-business, there are unclear words in the beginning and end stages of the market behavior, and the related enterprises may not understand the needs expressed by it, and interactive analysis needs to be performed; during the analysis, the system will analyze the factors and obtain the first analysis safety degree to overcome the problems caused by unclear words; generally, the related enterprises may be male risk control personnel, and the enterprise to be analyzed may be in deficit and other states; in environment A2, the first quantity upper limit can be, for example, 10; when the first cross-business obtained by the enterprise to be analyzed is The number of one channel is not less than the first upper limit, which means that in the first period, the market behaviors of the enterprise to be analyzed are more or even more urgent, and the related enterprises may not be able to clearly understand the needs expressed by them, and need to perform interactive analysis; in environment A3, the mutual first channel obtained by the intersection range in the first cross-business refers to the intersection of the obtained ranges of the two first channels, which is generally the intersection of the market behaviors of the enterprise to be analyzed and the related enterprises, and the two first channels are regarded as a pair; the second upper limit can be, for example, 3. If the number of mutual first channels obtained by the intersection range in the first cross-business is not less than the second upper limit, it means that the market behaviors of the enterprise to be analyzed and the related enterprises cross many times, and the related enterprises may not be able to clearly understand the needs expressed by them, and need to perform interactive analysis; the above three first activation environments are set, which can be used separately or in combination in actual use, which greatly improves the accuracy and rationality of the timing of performing interactive analysis on the enterprise to be analyzed and the related enterprises.

[0106] In one embodiment, the second activation environment includes:

[0107] Environment B1: The number of second channels containing the second compliance keyword of the first analysis safety level in the third cross-business is not less than the third upper limit; and / or,

[0108] Environment B2: The second channel in the third cross-business whose coordinate sequence number is in the second reference sequence number interval contains the third compliance keyword; and / or,

[0109] Environment B3: The second channel whose coordinate number is in the third reference number interval in the third cross-business contains the fourth compliance keyword.

[0110] In environment B1, the second compliance keyword of the first analysis safety level is that the enterprise operation must comply with the internal rules and regulations of the enterprise, including the rules of the enterprise's code of business conduct. For example, the first analysis safety level is the strategy for adjusting the execution status of the enterprise to be analyzed, and the second compliance keyword is the keyword in the strategy; the third quantity upper limit can be, for example, 4; when the number of second channels containing the second compliance keyword of the first analysis safety level in the third cross-business is not less than the third quantity upper limit, it means that the related enterprise is responding to the execution requirements of the enterprise to be analyzed according to the first analysis safety level, and the first analysis safety level can be directly pushed to the enterprise to be analyzed; in environment B2, the second reference serial number interval can be the first 1, and the third compliance keyword is that the enterprise employees must abide by the good Good professional ethics and ethical standards, etc. When the second channel with a coordinate number in the third cross-business that is in the second reference number interval contains the third compliance keyword, it means that the medical market enterprise hopes that the system will directly perform analysis on the enterprise to be analyzed, and the first analysis safety degree can be directly pushed to the enterprise to be analyzed; in environment B3, the third reference number interval can be the last one, and the third compliance keyword is a market behavior keyword that reflects the temporary desire of the associated enterprise to have the system directly perform analysis on the enterprise to be analyzed. When the second channel with a coordinate number in the third cross-business that is in the third reference number interval contains the fourth compliance keyword, it means that the associated enterprise temporarily hopes that the system will directly perform analysis on the enterprise to be analyzed, and the first analysis safety degree can be directly pushed to the enterprise to be analyzed. The embodiment of the present invention sets the above three second activation environments, accurately obtains the opportunity to directly push the first analysis safety degree to the enterprise to be analyzed, and improves the applicability of the system.

[0111] The embodiment of the present invention provides an enterprise security behavior analysis system based on risk assessment, such as Figure 2 As shown, including:

[0112] The real-time collection unit 1 is used to collect the current risk assessment behavior of the enterprise to be analyzed in real time after the enterprise to be analyzed reports the risk assessment instruction demand;

[0113] The safety degree obtaining unit 2 is used for obtaining the risk assessment safety degree based on the risk assessment behavior mapping table and the risk assessment behavior;

[0114] The safety degree push unit 3 is used to push the risk assessment safety degree to the enterprise to be analyzed;

[0115] Enterprise query unit 4, used for querying related upstream and downstream enterprises for the enterprise to be analyzed to perform interaction after reporting the request for help instruction when browsing the risk assessment safety degree;

[0116] The interactive analysis unit 5 is used to perform interactive analysis on the enterprise to be analyzed and its associated enterprises.

[0117] The interactive analysis unit performs interactive analysis on the enterprise to be analyzed and the associated enterprises, including:

[0118] Log the behavior node attribute data of the enterprise to be analyzed and receive the log record queue;

[0119] Generates analysis behavior mapping table of logging queue;

[0120] When the first cross-business obtained by the enterprise to be analyzed and the associated enterprise in the first cycle meets the first activation environment, the second cross-business obtained by the enterprise to be analyzed in the second cycle is subjected to element analysis, and a first element set is received;

[0121] According to the analysis behavior mapping table, based on the first element set, a first analysis safety degree is obtained;

[0122] Push the first analysis safety level to related enterprises;

[0123] When the third cross-business obtained by the associated enterprise in the third period meets the second activation environment, the first analysis safety level is pushed to the enterprise to be analyzed; otherwise, the fourth cross-business obtained by the associated enterprise in the fourth period is subjected to element analysis, and a second element set is received;

[0124] According to the analysis behavior mapping table, based on the second element set, a second analysis safety degree is obtained;

[0125] Push the second analysis safety level to the enterprise to be analyzed;

[0126] The first period is the period after the enterprise to be analyzed and the associated enterprise start to interact, and the random range interval is the upper limit of the first range interval;

[0127] The second period is consistent with the source range stamp of the first period; the interval by which the second period is greater than the first period is equal to the upper limit of the second range interval;

[0128] The third period is after the second period and adjacent to the second period; the range interval of the third period is equal to the upper limit of the third range interval;

[0129] The source range stamp of the fourth period is consistent with that of the third period; the interval by which the fourth period is greater than the third period is equal to the upper limit of the fourth range.

[0130] The interaction analysis unit generates an analysis behavior mapping table of the log record queue, including:

[0131] Collect multiple sets of one-to-one associated analysis samples and reference log record queues;

[0132] Query the logging queue with any reference logging queue;

[0133] When the query is satisfied, the analysis samples associated with the reference log record queue that satisfies the query are used as samples to be queued;

[0134] Generate an analysis behavior mapping table based on the samples to be added to the team.

[0135] The first activation environment includes:

[0136] The coordinate sequence number of the first channel containing the first compliance keyword in the first cross-business is in the first reference sequence number interval; and / or,

[0137] The number of first channels obtained by the enterprise to be analyzed in the first cross-business is not less than the first upper limit; and / or,

[0138] The number of pairs of mutual first channels obtained in the cross-range in the first cross-service is not less than the second upper limit.

[0139] The second activation environment includes:

[0140] The number of second channels in the third cross-business that contain the second compliance keyword with the first analysis safety level is not less than the third upper limit; and / or,

[0141] The second channel in the third cross-business whose coordinate sequence number is in the second reference sequence number interval contains the third compliance keyword; and / or,

[0142] The second channel whose coordinate serial number in the third cross-business is in the third reference serial number interval includes the fourth compliance keyword.

[0143] Those skilled in the art will appreciate that the contents disclosed in this disclosure may be subject to various modifications and improvements. For example, the various devices or components described above may be implemented by hardware, or by software, firmware, or a combination of some or all of the three.

[0144] Flowcharts are used in this disclosure to illustrate the steps of the method based on the embodiments of the present disclosure. It should be understood that the preceding or following steps are not necessarily performed precisely in order. On the contrary, various steps may be processed in reverse order or simultaneously. At the same time, other operations may also be added to these processes.

[0145] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits. Accordingly, each unit / unit in the above embodiment can be implemented in the form of hardware or in the form of a software functional unit. The present disclosure is not limited to any particular form of combination of hardware and software.

[0146] Unless otherwise defined, all terms used herein have the same meaning as commonly understood by those of ordinary skill in the art to which the present disclosure belongs. It should also be understood that terms such as those defined in common dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant technology, and should not be interpreted in an idealized or highly formal sense, unless explicitly defined as such herein.

[0147] The above is an explanation of the present disclosure and should not be considered as a limitation thereof. Although several exemplary embodiments of the present disclosure are described, it will be readily understood by those skilled in the art that many modifications may be performed to the exemplary embodiments without departing from the novel teachings and advantages of the present disclosure. Therefore, all such modifications are intended to be included within the scope of the present disclosure as defined in the claims. It should be understood that the above is an explanation of the present disclosure and should not be considered to be limited to the specific embodiments disclosed, and modifications to the disclosed embodiments and other embodiments are intended to be included within the scope of the appended claims. The present disclosure is defined by the claims and their equivalents.

[0148] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to a consistent embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0149] Although embodiments of the present invention have been shown and described, those skilled in the art will appreciate that various transformations, modifications, substitutions and variations may be performed on the embodiments without departing from the principles and spirit of the present invention, the scope of the present invention being defined by the claims and their equivalents.

Claims

1. A method for analyzing enterprise security behavior based on risk assessment, characterized in that: include: When the enterprise to be analyzed reports the risk assessment instruction requirements, the current risk assessment behavior of the enterprise to be analyzed is collected in real time; Based on the risk assessment behavior mapping table and the risk assessment behavior, the risk assessment safety degree is obtained; Push risk assessment safety to the enterprise to be analyzed; When the enterprise to be analyzed reports the need for assistance when browsing the risk assessment safety level, the enterprise to be analyzed queries the related upstream and downstream enterprises for interaction; Perform interactive analysis on the enterprise to be analyzed and its related enterprises.

2. The enterprise security behavior analysis method based on risk assessment according to claim 1 is characterized in that: The interactive analysis of the enterprise to be analyzed and its related enterprises includes: Log the behavior node attribute data of the enterprise to be analyzed and receive the log record queue; Generates analysis behavior mapping table of logging queue; When the first cross-business obtained by the enterprise to be analyzed and the associated enterprise in the first cycle meets the first activation environment, the second cross-business obtained by the enterprise to be analyzed in the second cycle is subjected to element analysis, and a first element set is received; According to the analysis behavior mapping table, based on the first element set, a first analysis safety degree is obtained; Push the first analysis safety level to related enterprises; When the third cross-service obtained by the associated enterprise in the third period meets the second activation environment, the first analysis safety level is pushed to the enterprise to be analyzed; otherwise, the fourth cross-service obtained by the associated enterprise in the fourth period is subjected to element analysis, and a second element set is received; According to the analysis behavior mapping table, based on the second element set, a second analysis safety degree is obtained; Push the second analysis safety level to the enterprise to be analyzed; The first period is the period after the enterprise to be analyzed and the associated enterprise start to interact, and the random range interval is the upper limit of the first range interval; The second period is consistent with the source range stamp of the first period; the interval by which the second period is greater than the first period is equal to the upper limit of the second range interval; The third period is after the second period and adjacent to the second period; the range interval of the third period is equal to the upper limit of the third range interval; The source range stamp of the fourth period is consistent with that of the third period; the interval by which the fourth period is greater than the third period is equal to the upper limit of the fourth range.

3. The enterprise security behavior analysis method based on risk assessment according to claim 2 is characterized in that: The analysis behavior mapping table of generating the log record queue includes: Collect multiple sets of one-to-one associated analysis samples and reference log record queues; Query the logging queue with any reference logging queue; When the query is satisfied, the analysis samples associated with the reference log record queue that satisfies the query are used as samples to be queued; Generate an analysis behavior mapping table based on the samples to be added to the team.

4. The enterprise security behavior analysis method based on risk assessment according to claim 2 is characterized in that: The first activation environment includes: The coordinate sequence number of the first channel containing the first compliance keyword in the first cross-business is in the first reference sequence number interval; and / or, The number of first channels obtained by the enterprise to be analyzed in the first cross-business is not less than the first upper limit; and / or, The number of pairs of mutual first channels obtained in the cross-range in the first cross-service is not less than the second upper limit.

5. The enterprise security behavior analysis method based on risk assessment according to claim 2 is characterized in that: The second activation environment includes: The number of second channels in the third cross-business that contain the second compliance keyword with the first analysis safety level is not less than the third upper limit; and / or, The second channel in the third cross-business whose coordinate sequence number is in the second reference sequence number interval contains the third compliance keyword; and / or, The second channel whose coordinate serial number in the third cross-business is in the third reference serial number interval includes the fourth compliance keyword.

6. An enterprise security behavior analysis system based on risk assessment, characterized in that: include: A real-time collection unit is used to collect the current risk assessment behavior of the enterprise to be analyzed in real time after the enterprise to be analyzed reports the risk assessment instruction requirements; A safety degree obtaining unit is used to obtain a risk assessment safety degree based on a risk assessment behavior mapping table and a risk assessment behavior; A safety degree push unit is used to push the risk assessment safety degree to the enterprise to be analyzed; The enterprise query unit is used to query the upstream and downstream enterprises related to the enterprise to be analyzed for interaction after reporting the request for help when browsing the risk assessment safety degree of the enterprise to be analyzed; The interactive analysis unit is used to perform interactive analysis on the enterprise to be analyzed and its related enterprises.

7. The enterprise security behavior analysis system based on risk assessment according to claim 6 is characterized in that: The interactive analysis unit performs interactive analysis on the enterprise to be analyzed and the associated enterprises, including: Log the behavior node attribute data of the enterprise to be analyzed and receive the log record queue; Generates analysis behavior mapping table of logging queue; When the first cross-business obtained by the enterprise to be analyzed and the associated enterprise in the first cycle meets the first activation environment, the second cross-business obtained by the enterprise to be analyzed in the second cycle is subjected to element analysis, and a first element set is received; According to the analysis behavior mapping table, based on the first element set, a first analysis safety degree is obtained; Push the first analysis safety level to related enterprises; When the third cross-service obtained by the associated enterprise in the third period meets the second activation environment, the first analysis safety level is pushed to the enterprise to be analyzed; otherwise, the fourth cross-service obtained by the associated enterprise in the fourth period is subjected to element analysis, and a second element set is received; According to the analysis behavior mapping table, based on the second element set, a second analysis safety degree is obtained; Push the second analysis safety level to the enterprise to be analyzed; The first period is the period after the enterprise to be analyzed and the associated enterprise start to interact, and the random range interval is the upper limit of the first range interval; The second period is consistent with the source range stamp of the first period; the interval by which the second period is greater than the first period is equal to the upper limit of the second range interval; The third period is after the second period and adjacent to the second period; the range interval of the third period is equal to the upper limit of the third range interval; The source range stamp of the fourth period is consistent with that of the third period; the interval by which the fourth period is greater than the third period is equal to the upper limit of the fourth range.

8. The enterprise security behavior analysis system based on risk assessment according to claim 7 is characterized in that: The interaction analysis unit generates an analysis behavior mapping table of the log record queue, including: Collect multiple sets of one-to-one associated analysis samples and reference log record queues; Query the logging queue with any reference logging queue; When the query is satisfied, the analysis samples associated with the reference log record queue that satisfies the query are used as samples to be queued; Generate an analysis behavior mapping table based on the samples to be added to the team.

9. The enterprise security behavior analysis system based on risk assessment according to claim 7 is characterized in that: The first activation environment includes: The coordinate sequence number of the first channel containing the first compliance keyword in the first cross-business is in the first reference sequence number interval; and / or, The number of first channels obtained by the enterprise to be analyzed in the first cross-business is not less than the first upper limit; and / or, The number of pairs of mutual first channels obtained in the cross-range in the first cross-service is not less than the second upper limit.

10. The enterprise security behavior analysis system based on risk assessment according to claim 7 is characterized in that: The second activation environment includes: The number of second channels in the third cross-business that contain the second compliance keyword with the first analysis safety level is not less than the third upper limit; and / or, The second channel in the third cross-business whose coordinate sequence number is in the second reference sequence number interval contains the third compliance keyword; and / or, The second channel whose coordinate serial number in the third cross-business is in the third reference serial number interval includes the fourth compliance keyword.

Images